there are some bad links in and to the Threat Model #84

As reported in #80 by @alexfigtree (and lightly edited for this tracking issue, opened to track the problem until [as reasonably desired by @iherman] the exact, final place for the threat-model [its own WG Note, included within the specification, somewhere else] has been resolved.)

The link at the top of the Threat Model appendix used data-cite="VC-DATA-MODEL-2.1#threat-model", but VC-DATA-MODEL-2.1 has no #threat-model anchor (its security content lives under "Security Considerations", and there's a separate "Trust Model" section — neither matches). The general VC threat model is actually published as its own companion document, currently only as an editor's draft at https://w3c.github.io/vc-data-model/threat-model/ (no /TR/ version exists yet).

The link should be directly to that document instead, matching the plain-href pattern this spec already uses a few lines above for its own companion threat-model document.